CVE-2026-57294: Jenkins EC2 Fleet Plugin missing permission check in AWS credential handling

CVE-2026-57294 · Severity: medium · CVSS 5.4 · Published 2026-06-24

The Jenkins EC2 Fleet Plugin, which manages Amazon EC2 instances for build tasks, contains a security flaw where it fails to verify user permissions for certain actions. This allows an attacker with basic access to the Jenkins dashboard to trick the system into sending sensitive AWS credentials to a server they control. If exploited, this could lead to the theft of cloud infrastructure credentials, potentially allowing unauthorized access to the organization's Amazon Web Services environment.

Vendors: Jenkins Project, Maven.

Quick answers

Is CVE-2026-57294 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-57294 being exploited in the wild.
How severe is CVE-2026-57294?
Medium severity, with a CVSS score of 5.4, published 24 June 2026.
Which products and versions are affected?
Jenkins Project EC2 Fleet Plugin 4.2.3.539.v8fedff2a_81c3 and earlier; com.amazon.jenkins.fleet:ec2-fleet (Maven) < 4.2.3.540.va, ECOSYSTEM:introduced=0,fixed=4.2.3.540.va.
Is there a fix for CVE-2026-57294?
Yes. com.amazon.jenkins.fleet:ec2-fleet (Maven): upgrade to 4.2.3.540.va or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57294 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-57294?
Check whether you run Jenkins Project EC2 Fleet Plugin or com.amazon.jenkins.fleet:ec2-fleet (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • com.amazon.jenkins.fleet:ec2-fleet (Maven): upgrade to 4.2.3.540.va or later
    # set com.amazon.jenkins.fleet:ec2-fleet to 4.2.3.540.va in your pom.xml or build.gradle

Technical details

A missing permission check in Jenkins EC2 Fleet Plugin versions 4.2.3.539.v8fedff2a_81c3 and earlier allows an attacker with Overall/Read permission to exploit an unprotected HTTP endpoint. By providing an attacker-specified URL and a credential ID (obtained through separate means), the attacker can force the plugin to initiate a connection to that URL using the specified credentials. This results in the transmission and subsequent capture of sensitive AWS credentials stored within the Jenkins credential store. The vulnerability is categorized as a missing authorization check (CWE-862).

Affected products

  • Jenkins Project EC2 Fleet Plugin 4.2.3.539.v8fedff2a_81c3 and earlier

Identifiers

  • CVE-2026-57294
  • GHSA-9v77-j4xv-34gq

Timeline

  • 2026-06-24: disclosed: Initial advisory publication

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.